diff --git a/services/dev/gitea.nix b/services/dev/gitea.nix
index 0b5c51b..c2fdc84 100644
--- a/services/dev/gitea.nix
+++ b/services/dev/gitea.nix
@@ -21,38 +21,20 @@ let
   # nothing she does lands without darman clicking merge.
   lunaRepos = [ "darman/homelab" ];
 
-  # Send every Gitea event to Hermes on mars. Hermes owns the decision about
-  # which events matter and what to do with them: its route filters on
-  # X-GitHub-Event and drops the rest before any LLM call, so narrowing this
-  # list would only move that policy to the wrong side of the wire.
+  # Only the event Hermes's gitea-pr-comments route actually handles. Gitea
+  # sends pull_request_comment distinctly from issue_comment, so this covers
+  # comments on PRs and nothing else — no issue comments, no pushes.
+  #
+  # Hermes would drop the rest anyway (its route filters on X-GitHub-Event
+  # before any LLM call), so this is defence in depth rather than the only
+  # gate: it keeps traffic that can never be acted on from crossing the wire
+  # and reaching the agent's process at all. Adding a second Hermes route
+  # means adding its event here as well as subscribing it.
   giteaWebhookEvents = [
-    "create"
-    "delete"
-    "fork"
-    "push"
-    "issues"
-    "issue_assign"
-    "issue_label"
-    "issue_milestone"
-    "issue_comment"
-    "pull_request"
-    "pull_request_assign"
-    "pull_request_label"
-    "pull_request_milestone"
     "pull_request_comment"
-    "pull_request_review_approved"
-    "pull_request_review_rejected"
-    "pull_request_review_comment"
-    "pull_request_sync"
-    "pull_request_review_request"
-    "wiki"
-    "repository"
-    "release"
-    "package"
-    "status"
-    "workflow_run"
-    "workflow_job"
   ];
+
+  giteaWebhookName = "PR comments Hermes";
 in
 {
   services.gitea = {
@@ -396,8 +378,9 @@ in
       # runs as the gitea user on a multi-user box, and a request body passed
       # with -d is world-readable in /proc/<pid>/cmdline for its lifetime.
       body="$(jq -n --arg url "$target" --arg secret "$secret" \
+        --arg name ${lib.escapeShellArg giteaWebhookName} \
         --argjson events '${builtins.toJSON giteaWebhookEvents}' \
-        '{type: "gitea", config: {content_type: "json", url: $url, secret: $secret}, events: $events, active: true}')"
+        '{type: "gitea", name: $name, config: {content_type: "json", url: $url, secret: $secret}, events: $events, active: true}')"
 
       hook_id="$(curl -fsS "''${auth[@]}" "$api/repos/darman/homelab/hooks" \
         | jq -r --arg url "$target" 'first(.[] | select(.type == "gitea" and .config.url == $url)) | .id // empty')"